Added support for CSRF in HTTP headers

I ran into a use case with AngularJS, which uses retrieves the CSRF token from a cookie (`XSRF-TOKEN`) and returns it to the server on an HTTP header (`x-xsrf-token`), where all my XHR requests were returning a `403` error.

I decided to add support for CSRF tokens in the `x-xsrf-token` header, as well as the widely used `x-csrf-token` HTTP header.